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This thesis will provide a review and evaluation of the 
internal control program in the Department of the Navy. 

Topics considered include: the evolution of the term 

internal control both in the private and public sectors; the 
theoretical background of R. N. Anthony's planning and control 
system and his management control process; the establishment 
and review of internal control systems within both sectors; and 
illustrative cases which demonstrate the inadequacy of focus- 
ing on the narrow interpretation of internal accounting control. 
It is the author's belief that management control — measures 
employed by management to reach its objectives — is the only 
meaningful framework within which the subsets of administra- 
tive and accounting controls must be combined for the effec- 
tive and efficient accomplishment of the organization's objec- 
tives, whether of the public or private sector. 

The research consisted primarily of a detailed search and 
evaluation of the literature in the area of internal control 
and management control. 
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I . 



INTRODUCTION 



A. PURPOSE 

As concern over the numerous cases of fraud, waste, abuse, 
and mismanagement of programs has grown, new legal amendments, 
directives and standards have been developed to strengthen 
internal control systems in the Federal Government as a prevent- 
ive measure. There is a critical need for "... Senior executive 
Service, Merit Pay, senior military equivalents and other 
civilian and military employees with significant management 
responsibilities ..." [Ref. 1] to gain a knowledge and under- 
standing of the concept of internal control and their respon- 
sibilities in this area in order to guide the implementation 
of effective systems within their organization. The purpose 
of this thesis is to provide the requisite knowledge and 
understanding for these Department of Defense (DOD) managers. 

B . BACKGROUND 

Despite the fact that internal controls have not been a 
major management priority, the recognition of their importance 
in the Federal Government is not new. The Accounting and 
Auditing Act of 1950 placed the responsibility for establish- 
ing and maintaining adequate systems of internal control upon 
the head of each executive agency. The Act encompassed not 
only systems of internal control that provide full disclosure 
of an agency's financial results, adequate financial 
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information for agency management purposes, reliable accounting 
results and suitable integration of agency accounting with 
Treasury Department accounting, but also systems of internal 
control that provide effective control over the account- 
ability of all funds, property, and other assets for which 
the agency is responsible. Thus, as early as 1950, the law 
clearly indicated that proper systems of accounting and in- 
ternal control were necessary for program and operational 
activities, as well as for financial and administrative 
functions . 

Even so, the development of effective systems has been 

slow. Recent public disclosures of fraud, waste, and abuse, 

and findings of poor internal controls such as those noted in 

a study by the U.S. General Accounting Office (GAO) have caused 

concern among responsible federal officials and taxpayers: 

... the loss to the Government on the 77,000 cases would 
total between $150 and $220 million. These losses are 
only what is attributable to known fraud and other 
illegal activities investigated by the Federal agencies 
in this study. It does not include ... the cost of 
undetected fraud which is probably much higher because 
weak internal controls allow fraud to flourish . . . the 
cost of fraud and illegal activities cannot always be 
measured in dollars and cents. Fraud erodes public 
confidence in the Government's ability to efficiently 
and effectively manage its programs. [Ref. 2] 

Within the last several years increased attention has been 

directed toward strengthening internal controls to prevent 

illegal, unauthorized, or questionable actions, to help restore 

confidence in Government, and to improve its operations. 

These, and other developments, will be reviewed. 
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C. SCOPE AND METHODOLOGY 

This thesis will provide a review and evaluation of the 
internal control program in the Department of the Navy. 

The evolution of the term internal control will be put 
into perspective by presenting the development within the 
private sector and then comparing it to the evolution of the 
expression in the public sector. 

The theoretical background of R. N. Anthony's Planning and 
Control System and his management control process will be 
reviewed in order to provide a general structure within which 
to integrate the specific systems of internal control of the 
private and public sectors. 

Managers in both sectors share the common concerns of 
obtaining and utilizing resources effectively and efficiently 
in accomplishing the objectives of their organizations. Yet 
the definitive literature concerning the subject of establish- 
ing and reviewing internal controls provides assistance to 
independent auditors in their review of financial controls 
and does not address the spectrum of administrative, as well 
as, accounting controls necessary to meet managers' 
requirements. As an assistance, a more comprehensive method- 
ology for establishing an internal control system which 
emphasizes program and operational controls, as well as 
financial and administrative ones, is presented for use by 
federal managers. 
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The internal accounting controls of the private sector 
will be integrated within Anthony's management control frame- 
work, as will DOD ' s Planning, Programming, and Budgeting 
System. 

A number of illustrative cases will demonstrate the 
inadequacy of focusing on the narrow interpretation of internal 
accounting control when the real intent is management control. 

Finally, the conclusion is reached that management 
control — measures employed by management to reach its 
obj ectives--is the only meaningful framework within which the 
subsets of administrative and accounting controls must be 
combined for the effective and efficient accomplishment of 
the organizations' objectives, whether of the public or 
private sector. 

The research consisted primarily of a detailed search and 
evaluation of the literature in the area of internal control 
and management control. 
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II. EVOLUTION OF THE TERM INTERNAL CONTROL 



A. INTRODUCTION 

The following chapters will compare the development of 
the concept of internal control in the private sector with 
the evolution in the public arena. Topics to be considered 
are: definitional concerns, the establishment of a system of 

internal control and its purpose, the process of internal 
control reviews, and finally, a conceptualization of the 
concept from a management perspective. 

B. EVOLUTION OF DEFINITION IN THE PRIVATE SECTOR 

A major concern with internal control in the private 
sector arises from the function of the independent audit — 
the independent investigation of a business firm's financial 
statements by Certified Public Accountants (CPAs) . In this 
context, management of the business firm is responsible for 
adopting sound accounting policies, accounting procedures, 
and the presentation of financial data. The independent auditor 
or CPA, based on his or her review of evidence relating to 
the reliability of financial data and the safeguarding of 
assets and records, provides an independent opinion on the 
fairness of management's presentation of financial data as 
a basis for third party reliance. 

Since the volume of transactions within most commercial 
firms precludes review of each and every economic event, one 
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of the ten Generally Accepted Auditing Standards states: 

There is to be a proper study and evaluation of the exist- 
ing internal control as a basis for reliance thereon and 
for the determination of the resultant extent of the 
tests to which auditing procedures are to be restricted. 
[Ref. 3] 

Utilizing this professional standard established by the 
American Institute of Certified Public Accountants (AICPA) in 
the late 1940 's, the auditor can effectively limit the amount 
of audit evidence accumulated, if he believes that the client 
has a system of internal control which provides reliable 
financial information and protects assets and records. If he 
determines any of the internal controls are inadequate, he 
cannot rely on them and must seek a greater quantity of 
evidence . 

Note that this audit standard, as well as the other nine, 
is broad and does not provide a detailed methodology for 
accomplishment. It is meant to serve as a guide to the 
selection of the proper procedures based on the individual 
auditor's judgment of the pertinent methods appropriate to a 
situation. In fact, judgment is heavily emphasized in the 
application of audit standards. 

The definition of the term internal control has varied in 
the private sector since the 1930s. 

In 1949 the Committee on Auditing Procedures (CAP) of the 

AICPA formally defined the term as: 

Internal control comprises the plan of organization and 
all of the coordinate methods and measures adopted within 
a business to safeguard its assets, check the accuracy 
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and reliability of its accounting data, promote opera- 
tional efficiency, and encourage adherence to prescribed 
managerial policies. [Ref. 4] 

This definition is broader than the meaning presently at- 
tributed to the term by practicing auditors. By the inclusion 
of the phrase " ... promote operational efficiency and 

encourage adherence to prescribed managerial policies," this 
statement recognizes that a system of internal control extends 
beyond those matters which are directly of an accounting or 
financial nature. 

Such a system might include budgeting control, standard 
costs, periodic operating reports, statistical analysis ... 
a training program ... to aid personnel in meeting their 
responsibilities, and an internal audit staff to provide 
additional assurance to management as to the adequacy 
of its outlined procedures and the extent to which they 
are being carried out. It properly comprehends activities 
in other fields (such as) time and motion studies ... and 
use of quality controls. [Ref. 5] 

Such a definition was perceived as too expansive for 
Certified Public Accountants' purposes, so the accounting 
profession subdivided the term into accounting controls and 
administrative controls in an effort to narrow the auditor's 
review as it pertains to his examination leading to the ex- 
pression of an opinion on financial statements. In response 
to critics of the above definition of internal control, CAP 
modified the definition in 1958 as follows: 

Internal control , in the broad sense includes: control 

which may be characterized as either accounting or 
administrative as follows: 

Accounting controls comprise the plan of organization and 
all the methods and procedures that are concerned mainly 
with, and relate directly to the safeguarding of assets 
and the reliability of the financial records. They 
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generally include such controls as the systems of authoriza- 
tion and approval, separation of duties concerned with 
record keeping and accounting reports from those concerned 
with operations or asset custody, physical controls over 
assets and internal auditing. 

Administrative controls comprise the plan of organization 
and all the methods and procedures that are concerned 
mainly with operational efficiency and adherence to 
managerial policies and usually relate only indirectly 
to the financial records. They generally include such 
controls as statistical analysis, time and motion studies, 
performance reports, employee training programs, and 
quality controls. [Ref. 6] 

In 1963 CAP further narrowed the independent auditor's 

responsibility for evaluating internal control: 

The independent auditor is primarily concerned with the 
accounting controls. Accounting controls ... generally 
bear directly and importantly on the reliability of 
financial records and require evaluation by the auditor. 
Administrative controls . . . ordinarily relate only 
indirectly to the financial records and thus would not 
require evaluation. [Ref. 7] 

Not everyone agreed with this limitation of the concept 

which served to narrow the scope of the independent CPA's 

review. In 1957 Paul Grady, chairman of CAP when the original 

broad definition was issued, commented on the controversy: 

The suggested narrowing of viewpoint, in my opinion, would 
constitute serious retrogression and impair the founda- 
tion of independent auditing. It may sound paradoxical, 
but there are many endeavors wherein a broader concept of 
responsibility results in a lesser risk. In the present 
international situation the recently announced Middle 
East Policy obviously broadens our responsibility. We 
have undertaken it, however, in order to lessen the risk 
of war. Similarly, the broader view of investigation and 
evaluation of internal control lessens the business risk 
inherent in the work of the independent auditor. [Ref. 8] 

Despite this warning, the auditing profession proceeded 
to practice the narrower concept. As time passed, the 
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independent auditor's evaluation of management's policies 
was found lacking in a number of legal cases. These legal 
proceedings applied the internal control concept as estab- 
lished in the inclusive 1949 framework when evaluating the 
auditor's actions. 

Because of difficulties in interpretation, CAP felt that 
clarification of the two types of internal control was 
desirable. In 1972, the revised statements were promulgated 
as follows: 

Administrative control includes, but is not limited to 
the plan of organization and the procedures and records 
that are concerned with the decision processes leading 
to management's authorization of transactions. Such 
authorization is a management function directly asso- 
ciated with the responsibility for achieving the 
objectives of the organization and is the starting point 
for establishing accounting control of transactions. 

Accounting control comprises the plan of organization and 
the procedures and records that are concerned with the 
safeguarding of assets and the reliability of financial 
records and consequently are designed to provide reason- 
able assurance that: 

- Transactions are executed in accordance with manage- 
ment's general or specific authorization. 

- Transactions are recorded as necessary (1) to permit 
preparation of financial statements in conformity 
with generally accepted accounting principles or any 
other criteria applicable to such statements and (2) 
to maintain accountability for assets. 

- Access to assets is permitted only in accordance with 
management's authorization. 

- The recorded accountability for assets is compared 
with the existing assets at reasonable intervals 
and appropriate action is taken with respect to any 
differences. {Ref. 9] 
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The committee emphasized that accounting, not administra- 
tive, control was to be the focus of audits. 

Ignoring the court's interpretation of internal control 
in legal actions and the SEC disciplinary proceedings against 
auditors, in 1975, Statement on Auditing Standards (SAS) 

No. 9 explicitly narrowed the traditional reference to an 
evaluation of internal control to read "... evaluation of 
internal accounting control." This clearly separates internal 
control into that of a "financial" nature versus "management" 
control . 

During this period of the mid-1970's the Securities and 
Exchange Commission (SEC) censured several of the large audit- 
ing firms for lack of independence and certification of false 
financial statements and inadequate audit procedures. As a 
result, the public began to question the reliability of 
corporate financial statements and the role of the independent 
auditor. The AICPA requested that the Commission on Auditor's 
Responsibilities develop conclusions and recommendations 
regarding the appropriate responsibilities of independent 
auditors. This commission included a number of prominent 
non-accountants. Findings included the following: 

The Commission observed that financial reporting has 
become a continuous process rather than an annual event. 

Much of the information is therefore, unaudited ... 

More importantly users are implicitly relying on an 
adequate system of internal controls. Internal controls 
assure that unaudited information released by corporations 
is materially accurate. The Commission observed the 
societal concern over illegal and questionable corporate 
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payments and the attention focused on corporate account- 
ability and the importance of controls over the accounting 
system. The Commission noted that the adequacy o.f internal 
controls is an important investment criterion to creditors 
and shareholders. The Commission ... recommended that 
the auditors expand their study to review and test the 
entire accounting control system . . . greater involvement 
of the auditor in the corporate reporting system and a 
change in the auditor's focus ... to the examination of 
a function. [Ref. 10] 

Before the Commission on Auditor's Responsibilities issued 
its final report, the Auditing Standards Board of the AICPA 
issued SAS No. 20 in December 1977. This statement required 
auditors to inform management of material weaknesses in 
internal accounting control but it also continued to limit 
the scope of the auditor's review: 

"... there is no requirement under generally accepted 

auditing standards to evaluate each control ..." [Ref. 11] 

The independent auditor is only expected to test the controls 
upon which he intends to rely. 

During this same time period, the media reported on several 
cases of falsified corporate records and maintenance of off- 
the-books slush funds. 

As a result, Congress passed, and President Carter signed, 
the Foreign Corrupt Practices Act (FCPA) of 1977. Bribes or 
payments to foreign officials and others to obtain or retain 
business were indeed prohibited by this legislation but the 
important provisions required all publicly held companies to 
establish and maintain adequate systems of internal account- 
ing control defined as: 
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... a system of internal accounting controls sufficient 
to provide reasonable assurance that: 

- transactions are executed in accordance with management's 
general or specific authorization 

- transactions are recorded as necessary to permit prepara- 
tion of financial statements in conformity with generally 
accepted accounting principles or any other criteria 
applicable to such statements, and to maintain account- 
ability for assets 

- access to assets is permitted only in accordance with 
management's general or specific authorization 

- the recorded accountability for assets is compared with 
the existing assets at reasonable intervals and approp- 
riate action is taken with respect to any differences. 

Note that these points are directly derived from the profes- 
sional auditing literature, namely CAP's 1972 clarification 
of the types of internal control. 

In its interpretation of the internal accounting control 
provisions of the FCPA, the American Bar Association warned: 

... Foreign bribery is a relatively rare event, but 
maintenance of financial records and internal accounting 
controls are major everyday activities of every registered 
or reporting company . . . (this may be) the most extensive 
application of federal law in internal corporate affairs 
since the passage of the 1933 and 1934 (security) Acts 
. . . (others) foresee at least the possibility that the 
new statute will create extensive new liabilities for 
corporate managements, auditors, and corporate counsel. 

[Ref. 12] 

The AICPA appointed the Special Advisory Committee on 
Internal Accounting Control to provide guidance to management 
in reviewing and implementing internal controls. The forward 
to the Committee's report states that the broad guidance in 
the professional literature had been developed for the limited 
purpose of the auditing profession and noted the need to 
provide guidance helpful to management. 
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The Committee declared that management should be concerned 
with all of its internal accounting controls and cited the 
following broad definition from SAS No. 1 for management's 
purposes : 

The foregoing definitions (of .internal accounting control 
and administrative control) are not necessarily mutually 
exclusive because some of the procedures' and records 
comprehended in accounting control may also be involved in 
administrative control ... For practical purposes, this is 
tantamount to including within the definition of accounting 
controls any administrative controls that have an important 
bearing on the reliability of the financial statements. 

Thus the statement underlines the fact that as far as 
managers are concerned administrative and accounting controls 
are interrelated and both types reinforce management controls 
measures employed to obtain the organization's objectives. 

This discussion was not meant as a historical review of 
actions in the private sector but rather was an attempt to 
illustrate the development of the concept of internal control 
in the private sector from a broad expansive term, to a 
narrow limited focus for the benefit of the auditing profes- 
sion and a final recognition by that same profession that 
management's concerns are broader and that therefore the 
controls contemplated in the 1949 definition are more 
appropriate for them. 

C. EVOLUTION OF DEFINITION IN THE PUBLIC SECTOR 

As part of Reform 88, the Reagan Administration is com- 
mitted to streamlining the management and administration of 
the federal government. This initiative includes reducing 
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fraud, improving management controls and eliminating errors 
in the administration of government programs. 

In October 1981, the Office of Management & Budget (OMB) 
issued Circular A-123 on internal control systems as an early 
effort to improve these systems. The circular defined require- 
ments and responsibilities in order to transform the 1950 
Act's expectations into reality. It prescribed policies and 
standards for executive agencies in establishing and maintain- 
ing internal controls in their program and administrative 
functions . 



At that time OMB defined Internal Control (as) : 

the plan of organization and all of the methods and measures 
adopted within an agency to safeguard its resources, assure 
the accuracy and reliability of its information, assure 
adherence to applicable laws, regulations and policies, 
and promote operational economy and efficiency. [Ref. 13] 

This definition is very similar to the 1949 AICPA broad 



concept of internal control in that it includes: 



OMB Circular 



1949 Definition 



the safeguarding of resources 



safeguarding assets 



assuring the accuracy and re- 
liability of its information 



check the accuracy and 
reliability of its 
accounting data 



assuring adherence to applica- 
ble laws, regulations and 
policies 



encourage adherence to 
prescribed managerial 
policies 



promote operational economy 
and efficiency 



promote operational 
efficiency 



In fact, based on the parallel construction above, this 



definition is even more general than the original private 
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sector statement. In this format, it has served as the basis 
for much of the guidance promulgated to executive federal 
agencies . 

However, in August 1983, OMB issued a revised Circular 

A-123 which redefined Internal Control (as) : 

the plan of organization and methods and procedures adopted 
by management to provide reasonable assurance that obliga- 
tions and costs are in compliance with applicable law; funds, 
property and other assets are safeguarded against waste, 
loss, unauthorized use, or misappropriation; and revenues 
and expenditures applicable to agency operations are properly 
recorded and accounted for to permit the preparation of 
accounts and reliable financial and statistical reports 
and to maintain accountability over the assets. [Ref. 14] 

Note that this focus is narrower and related closely to the 
auditing profession's 1958 delineation of accounting controls. 
All references to the administrative controls, those of ad- 
herence to applicable laws, regulations, and policies and the 
promotion of operational economy and efficiency have been 
dropped . 

The Department of Defense (DOD) promulgated OMB ' s original 
Circular A-123 by issuing DOD Directive 7040.6, Internal Control 
Systems , 24 March 1982. This document established DOD ' s pro- 
gram of internal control, assigned responsibilities and 
provided procedures to ensure that DOD resources are efficiently 
and effectively managed. It also appropriated OMB ' s original 
broad definition of internal control. 

A policy statement of the directive served to support the 
broad formulation of the term: 
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Internal controls are management's responsibility and 
should be in effect across the board in every organiza- 
tion within each DOD component. Adequate internal 
control is required to assure that all resources are 
efficiently and effectively managed and is the basic 
foundation for integrity in any management system. 

Although internal controls in themselves cannot prevent 
every incident of waste, mismanagement and fraud, DOD 
policy is to ensure that resources are properly managed 
and controlled within the Department of Defense. [Ref. 15] 

A revision of DOD ' s directive is currently in draft form 
and a review of it indicates that DOD has adopted OMB ' s 
revised definition of internal control but has chosen to 
title it Management Control . It is interesting to note that 
a number of other definitions within the revision emphasize 
the "management" control aspect yet use the same meanings 
OMB has ascribed to internal control with an accounting focus, 
i.e., management control review, management control system. 

The revised paper still retains the original DOD policy 
statement concerning management's responsibility in relation 
to internal controls. 

In September 1982, Congress passed the Federal Managers' 
Financial Integrity Act (FMFIA) , an amendment to the pre- 
viously mentioned Accounting and Auditing Act of 1950 which 
placed the cognizance for the effectiveness of financial 
management systems in preventing fraud, waste, and abuse upon 
federal managers. 

One provision of the FMFIA requires that: 

Internal accounting and administrative controls . . . shall 
provide reasonable assurances that obligations and costs 
are in compliance with applicable law; funds, property 
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and other assets are safeguarded against waste, loss, 
unauthorized use, or misappropriation; and revenues and 
expenditures applicable to agency operations are properly 
recorded and accounted for. [Ref. 16] 

The revised definitions of internal control issued by OMB 
and DOD are certainly better aligned with the objectives of 
this provision which does not mention program results or 
operational economy and efficiency. 

Secretary of the Navy Instruction (.SECNAVINST 5200.35), 
Internal Control in the Department of the Navy , was issued on 
29 July 1983. It implemented the original versions of OMB ' s 
Circular and the DOD Directive, as well as the FMFIA , within 
the DON and established the Navy's own program to develop, 
maintain, review and improve internal control systems to en- 
sure resources are efficiently and effectively managed. 

Since DON's instruction is based on the first publications 
of OMB and DOD, one would expect that the Navy's definition 
would support the broader connotation of internal control and 
it does: 

. . . the plan of organization and all of the methods and 
measures adopted within the DON to: 

Safeguard resources and assure the accuracy and 
reliability of information (.accounting controls) 

Assure adherence to applicable laws, regulations, 
and policies and promote operational economy and 
efficiency (administrative controls. 

Internal controls are management controls and apply to 
the entire range of DON programs and functions. 

[Ref. 17] 
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Other statements within this instruction also stress the 

management aspects of internal controls: 

. . . implementing and carrying out an internal control 
program is a management responsibility. 

Vulnerability assessment. A management evaluation . . . 
Management control review . . . reviews performed by 
managers responsible for the program/function under 
review ... [Ref. 18] 

It is most likely that DON will revise its recent instruc 
tion to better coordinate with the latest guidance from OMB 
and DOD . 

D. CONCLUSION 

By now it should be clear that there are a number of 
similarities in the evolution of the definition of internal 
control within the private and public sectors. Both have 
long recognized the importance of adequate systems of control 
Both sectors began with a broad definition of internal con- 
trol and each has moved to a more limited view. Much impetus 
for current interest in this subject has developed because of 
recent legislation to correct failings in operations: the 

FCPA in the private sector and the FMFIA in the public sector 
There is little guidance in either sector on specifics; broad 
direction is all that is provided. 

In the private sector, the major portion of the profes- 
sional literature has been directed toward the purposes of 
the independent auditor who uses his own evaluation of 
management's system as a basis to limit the scope of his 
audit tests in financially related areas. 
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The public sector has taken the literature originated 
for these narrow purposes and tried to superimpose it on 
systems of internal control where a non-independent management 
has responsibility for its stewardship of all resources. 

It is unclear that the approach advocated by the auditing 
profession and the AICPA is necessarily correct for either 
public or private sector management. The inclusive interpre- 
tation as defined in 1948 can provide administrative, as well 
as accounting data -- all information management is responsible 
for. Thus, as Grady stated in 1957, "a broader concept of 
responsibility results in a lesser risk." 
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III. SYSTEMS OF INTERNAL CONTROL 



A. INTRODUCTION 

Management is responsible for establishing and maintaining 
its system of internal controls in order to provide reliable 
data, safeguard assets and records, and promote operational 
efficiency. The pioneer literature in this area of management 
planning and control systems was published in the 1960's by 
R. N. Anthony. A discussion of his framework will be presented 
in this section, as well as descriptions of internal control 
systems within the private and public domains. 

B. ANTHONY'S MANAGEMENT CONTROL FRAMEWORK 
1 . Planning and Controlling Processes 

In his book. Planning and Control Systems; A Framework 
for Analysis , Anthony presented his concept of systems designed 
to facilitate planning and control processes within organiza- 
tions, whether profit or nonprofit. 

Within the framework of deciding what to do and how to 
do it (planning) and assuring results are attained (controlling) , 
three main categories of internal activities carried on in an 
organization at different times, by different people, or for 
different situations can be delineated. Figure 1. 

Strategic planning is defined as the process of 
deciding on objectives of the organization, on changes in 
these objectives, on the resources used to attain these 
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